       false)))
 
 (defn- role-policy-document [account-id]
-  {"Version" "2012-10-17",
-   "Statement" [{"Sid" "",
-                 "Effect" "Allow",
-                 "Principal" {"Federated" (str "arn:aws:iam::" account-id ":saml-provider/Shibboleth")},
-                 "Action" "sts:AssumeRoleWithSAML",
+  {"Version" "2012-10-17"
+   "Statement" [{"Sid" ""
+                 "Effect" "Allow"
+                 "Principal" {"Federated" (str "arn:aws:iam::" account-id ":saml-provider/Shibboleth")}
+                 "Action" "sts:AssumeRoleWithSAML"
                  "Condition" {"StringEquals" {"SAML:aud" "https://signin.aws.amazon.com/saml"}}}]
    })
 

                           "ec2:DeleteVpcPeeringConnection"
                           "ec2:DeleteVpnConnection"
                           "ec2:DeleteVpnConnectionRoute"
                           "ec2:DeleteVpnGateway"]
                 "Resource" "*"}]
   })

(def ^:private read-only-policy


(def ^:private power-user-policy
  {
   "Statement" [{"Effect" "Allow"
                 "Resource" "*"
                 "Action" ["iam:CreateRole"
                           "iam:CreateInstanceProfile"
                           "iam:AddRoleToInstanceProfile"
                           "iam:PassRole"
                           "iam:ListVirtualMFADevices"
                           "iam:ListUsers"
                           "iam:ListUserPolicies"
                           "iam:ListSigningCertificates"
                           "iam:ListServerCertificates"
                           "iam:ListSAMLProviders"
                           "iam:ListRoles"
                           "iam:ListRolePolicies"
                           "iam:ListMFADevices"
                           "iam:ListInstanceProfilesForRole"
                           "iam:ListInstanceProfiles"
                           "iam:ListGroupsForUser"
                           "iam:ListGroups"
                           "iam:ListGroupPolicies"
                           "iam:ListAccountAliases"
                           "iam:ListAccessKeys"
                           "iam:GetAccountSummary"
                           "iam:GetInstanceProfile"
                           "iam:GetLoginProfile"
                           ; FIXME: PutRolePolicy allows privilege escalation!
                           "iam:PutRolePolicy"]}
                {"Effect" "Allow"
                 "Resource" "*"
                 "Condition" {"ForAnyValue:StringLike" {"ec2:Region" ["eu-central-1"
                                                                      "eu-west-1"]}}
                 "Action" "ec2:*"}
                {"Effect" "Allow"
                 "NotAction" ["ec2:*"
                              "iam:*"]
                 "Resource" "*"}
                {"Effect" "Deny"
                 "Resource" "*"
                 "Action" ["ec2:DeleteNetworkAcl"
                           "ec2:DeleteRoute"
                           "ec2:DeleteRouteTable"
